CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
408,097 CVEs
1,741 on KEV
17,306 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,621 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-3394 EXP | Multiple SQL injection vulnerabilities in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via the (1) artid parameter to mod.ph… | Patch early | 7.5 high | 2.1% | 2007-06-26 |
| CVE-2009-1450 EXP | PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP code via a URL in the _page_co… | Patch early | 7.5 high | 2.1% | 2009-04-28 |
| CVE-2009-3511 EXP | Multiple PHP remote file inclusion vulnerabilities in justVisual 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the fs_jVroot p… | Patch early | 7.5 high | 2.1% | 2009-10-01 |
| CVE-2009-4993 EXP | PHP remote file inclusion vulnerability in home.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the… | Patch early | 7.5 high | 2.1% | 2010-08-25 |
| CVE-2017-6328 EXP | The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviat… | Patch early | 8.8 high | 2.1% | 2017-08-11 |
| CVE-2009-0807 EXP | zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php. | Patch early | 7.5 high | 2.1% | 2009-03-04 |
| CVE-2007-2145 EXP | The imagecomments function in classes.php in MiniGal b13 allows remote attackers to inject arbitrary PHP code into a file in the thumbs/ directory via… | Patch early | 7.5 high | 2.1% | 2007-04-19 |
| CVE-2007-4389 EXP | Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG, 1800HW, and 2071 Gateway routers, with 3.17.5, 3.7.1, and 5.29.51 software,… | Patch early | 7.8 high | 2.1% | 2007-08-17 |
| CVE-2005-0931 EXP | PHP remote file inclusion vulnerability in The Includer 1.0 and 1.1 allows remote attackers to execute arbitrary PHP code. | Patch early | 7.5 high | 2.1% | 2005-03-29 |
| CVE-2007-0686 EXP | The Intel 2200BG 802.11 Wireless Mini-PCI driver 9.0.3.9 (w29n51.sys) allows remote attackers to cause a denial of service (system crash) via crafted… | Patch early | 7.1 high | 2.1% | 2007-02-03 |
| CVE-2026-67206 EXP | Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitra… | Patch early | 8.8 high | 2.1% | 2026-07-30 |
| CVE-2006-0462 EXP | SQL injection vulnerability in comentarios.php in AndoNET Blog 2004.09.02 allows remote attackers to execute arbitrary SQL commands via the entrada pa… | Patch early | 7.5 high | 2.1% | 2006-01-27 |
| CVE-2006-5141 EXP | PHP remote file inclusion vulnerability in script.php in Kevin A. Gordon Open Geo Targeting (aka geotarget) allows remote attackers to execute arbitra… | Patch early | 7.5 high | 2.1% | 2006-10-03 |
| CVE-2006-5436 EXP | PHP remote file inclusion vulnerability in index.php in FreeFAQ 1.0.e allows remote attackers to execute arbitrary PHP code via a URL in the faqpath p… | Patch early | 7.5 high | 2.1% | 2006-10-20 |
| CVE-2006-5899 EXP | PHP remote file inclusion vulnerability in install.php3 in @cid stats 2.3 allows remote attackers to execute arbitrary PHP code via a URL in the reper… | Patch early | 7.5 high | 2.1% | 2006-11-15 |
| CVE-2006-6140 EXP | PHP remote file inclusion vulnerability in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to execute arbitrary PHP code via a URL in the slnt… | Patch early | 7.5 high | 2.1% | 2006-11-28 |
| CVE-2007-4605 EXP | PHP remote file inclusion vulnerability in convert/mvcw.php in Virtual War (VWar) 1.5.0 R15 and earlier allows remote attackers to execute arbitrary P… | Patch early | 7.5 high | 2.1% | 2007-08-31 |
| CVE-2007-4606 EXP | PHP remote file inclusion vulnerability in convert/mvcw_conver.php in the Virtual War (VWar) module for PHPNuke-Clan (PNC) 4.2.0 and earlier allows re… | Patch early | 7.5 high | 2.1% | 2007-08-31 |
| CVE-2018-5976 EXP | Cross Site Request Forgery (CSRF) exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modifying the admin password. | Patch early | 8.8 high | 2.1% | 2018-01-24 |
| CVE-2007-5644 EXP | Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for (1) ajax/sortcategories.php and (2) ajax/sortroles.php, which allows remote at… | Patch early | 7.5 high | 2.1% | 2007-10-23 |
| CVE-2007-3814 EXP | Multiple SQL injection vulnerabilities in MKPortal 1.1.1 allow remote attackers to execute arbitrary SQL commands via (1) the idurlo field in the dele… | Patch early | 7.5 high | 2.1% | 2007-07-17 |
| CVE-2006-2541 EXP | SQL injection vulnerability in settings.asp in Zixforum 1.12 allows remote attackers to execute arbitrary SQL commands via the layid parameter to (1)… | Patch early | 7.5 high | 2.1% | 2006-05-23 |
| CVE-2015-1576 EXP | Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to (1) co… | Patch early | 7.5 high | 2.1% | 2015-02-11 |
| CVE-2006-3832 EXP | SQL injection vulnerability in index.php in Gerrit van Aaken Loudblog 0.5 and earlier allows remote attackers to execute arbitrary SQL commands via th… | Patch early | 7.5 high | 2.1% | 2006-07-25 |
| CVE-2015-0919 EXP | Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL com… | Patch early | 7.5 high | 2.1% | 2015-01-08 |
| CVE-2002-1614 EXP | Buffer overflow in HP Tru64 UNIX allows local users to execute arbitrary code via a long argument to /usr/bin/at. | Patch early | 7.2 high | 2.1% | 2002-09-09 |
| CVE-2007-1171 EXP | SQL injection vulnerability in includes/nsbypass.php in NukeSentinel 2.5.05, 2.5.11, and other versions before 2.5.12 allows remote attackers to execu… | Patch early | 7.5 high | 2.1% | 2007-03-02 |
| CVE-2006-1667 EXP | SQL injection vulnerability in slides.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka PHP thumbnail Photo Gallery) 3.1g and earlier allows… | Patch early | 7.5 high | 2.1% | 2006-04-07 |
| CVE-2007-4062 EXP | The SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via un… | Patch early | 7.8 high | 2.1% | 2007-07-30 |
| CVE-2008-3481 EXP | themes/sample/theme.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct requ… | Patch early | 7.5 high | 2.1% | 2008-08-05 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt